⬢ DragonFlyBSD Kernel Audit
DF-5680 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-5680",
  "file": "sys/libprop/prop_data.c",
  "title": "<data size=\"N\"> attribute drives unbounded kmalloc(len+1, M_PROP_DATA, M_WAITOK) in _prop_data_internalize: kernel panic (2^63) / system-wide vm_wait wedge (size > RAM), ERANGE guard compiled out in-kernel",
  "verdict": "reproduced",
  "impact": "panic",
  "confidence": "certain",
  "reproduce": {
    "build": "guest root, /tmp/df5680: sh build.sh (same-source libprop rig + triggers)",
    "run": "kldload dm; ./df5680_dmcrash panic   # stock: kernel panics; ./df5680_dmcrash hang  # stock: guest wedges; sh run.sh # userland differential (all clean)",
    "expected": "stock kernel: 'panic: kmem_slab_alloc(): kernel_map ran out of space!' with stack _prop_data_internalize -> _kmalloc -> kmem_slab_alloc (panic.txt); 8GiB variant: 'pagedaemon: WARNING! Continuous paging' + dead guest (hang.console.txt); patched kernel: both inputs -> clean EIO rejection, control plists unaffected"
  },
  "kernel_refs": [
    "sys/libprop/prop_data.c:572",
    "sys/libprop/prop_data.c:573-576",
    "sys/libprop/prop_data.c:588",
    "sys/kern/kern_slaballoc.c:1721-1724",
    "sys/kern/kern_slaballoc.c:1792-1800",
    "sys/libprop/prop_kern.c:398-411",
    "sys/dev/disk/dm/device-mapper.c:267"
  ],
  "artifacts": [
    "README.md", "VERDICT.md",
    "df5680_userland.c", "df5680_dmcrash.c", "df5680_mod.c",
    "build.sh", "run.sh",
    "build.log", "build.kernel.log",
    "run.userland.log",
    "panic.txt", "hang.console.txt",
    "fixtest.console.txt", "fixtest.module.txt",
    "env.txt", "fix.diff",
    "manifest.json", "verdict.json"
  ]
}